2023

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements und

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is

In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canon

imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these ar

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packag

CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you us

gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys sh

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0

A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instanc

Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Editi

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instea

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an a

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during f

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenan

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achie

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injec

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write

An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session dur

A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-stati

An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3

In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restric

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versio

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 vers

A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affec

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlin

A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet Syst

Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading con

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a craft

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via

OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via co

OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial di

OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resour

An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child ca

Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versi

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 ve

Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pro

pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticat

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin

Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file wi

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorre

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').